blob: 29c18966b0502c3489e1058bd361db50a6c07686 [file] [log] [blame]
Linus Torvalds1da177e2005-04-16 15:20:36 -07001
2 Linux kernel coding style
3
4This is a short document describing the preferred coding style for the
5linux kernel. Coding style is very personal, and I won't _force_ my
6views on anybody, but this is what goes for anything that I have to be
7able to maintain, and I'd prefer it for most other things too. Please
8at least consider the points made here.
9
10First off, I'd suggest printing out a copy of the GNU coding standards,
11and NOT read it. Burn them, it's a great symbolic gesture.
12
13Anyway, here goes:
14
15
16 Chapter 1: Indentation
17
18Tabs are 8 characters, and thus indentations are also 8 characters.
19There are heretic movements that try to make indentations 4 (or even 2!)
20characters deep, and that is akin to trying to define the value of PI to
21be 3.
22
23Rationale: The whole idea behind indentation is to clearly define where
24a block of control starts and ends. Especially when you've been looking
25at your screen for 20 straight hours, you'll find it a lot easier to see
26how the indentation works if you have large indentations.
27
28Now, some people will claim that having 8-character indentations makes
29the code move too far to the right, and makes it hard to read on a
3080-character terminal screen. The answer to that is that if you need
31more than 3 levels of indentation, you're screwed anyway, and should fix
32your program.
33
34In short, 8-char indents make things easier to read, and have the added
35benefit of warning you when you're nesting your functions too deep.
36Heed that warning.
37
38Don't put multiple statements on a single line unless you have
39something to hide:
40
41 if (condition) do_this;
42 do_something_everytime;
43
44Outside of comments, documentation and except in Kconfig, spaces are never
45used for indentation, and the above example is deliberately broken.
46
47Get a decent editor and don't leave whitespace at the end of lines.
48
49
50 Chapter 2: Breaking long lines and strings
51
52Coding style is all about readability and maintainability using commonly
53available tools.
54
55The limit on the length of lines is 80 columns and this is a hard limit.
56
57Statements longer than 80 columns will be broken into sensible chunks.
58Descendants are always substantially shorter than the parent and are placed
59substantially to the right. The same applies to function headers with a long
60argument list. Long strings are as well broken into shorter strings.
61
62void fun(int a, int b, int c)
63{
64 if (condition)
65 printk(KERN_WARNING "Warning this is a long printk with "
66 "3 parameters a: %u b: %u "
67 "c: %u \n", a, b, c);
68 else
69 next_statement;
70}
71
72 Chapter 3: Placing Braces
73
74The other issue that always comes up in C styling is the placement of
75braces. Unlike the indent size, there are few technical reasons to
76choose one placement strategy over the other, but the preferred way, as
77shown to us by the prophets Kernighan and Ritchie, is to put the opening
78brace last on the line, and put the closing brace first, thusly:
79
80 if (x is true) {
81 we do y
82 }
83
84However, there is one special case, namely functions: they have the
85opening brace at the beginning of the next line, thus:
86
87 int function(int x)
88 {
89 body of function
90 }
91
92Heretic people all over the world have claimed that this inconsistency
93is ... well ... inconsistent, but all right-thinking people know that
94(a) K&R are _right_ and (b) K&R are right. Besides, functions are
95special anyway (you can't nest them in C).
96
97Note that the closing brace is empty on a line of its own, _except_ in
98the cases where it is followed by a continuation of the same statement,
99ie a "while" in a do-statement or an "else" in an if-statement, like
100this:
101
102 do {
103 body of do-loop
104 } while (condition);
105
106and
107
108 if (x == y) {
109 ..
110 } else if (x > y) {
111 ...
112 } else {
113 ....
114 }
115
116Rationale: K&R.
117
118Also, note that this brace-placement also minimizes the number of empty
119(or almost empty) lines, without any loss of readability. Thus, as the
120supply of new-lines on your screen is not a renewable resource (think
12125-line terminal screens here), you have more empty lines to put
122comments on.
123
124
125 Chapter 4: Naming
126
127C is a Spartan language, and so should your naming be. Unlike Modula-2
128and Pascal programmers, C programmers do not use cute names like
129ThisVariableIsATemporaryCounter. A C programmer would call that
130variable "tmp", which is much easier to write, and not the least more
131difficult to understand.
132
133HOWEVER, while mixed-case names are frowned upon, descriptive names for
134global variables are a must. To call a global function "foo" is a
135shooting offense.
136
137GLOBAL variables (to be used only if you _really_ need them) need to
138have descriptive names, as do global functions. If you have a function
139that counts the number of active users, you should call that
140"count_active_users()" or similar, you should _not_ call it "cntusr()".
141
142Encoding the type of a function into the name (so-called Hungarian
143notation) is brain damaged - the compiler knows the types anyway and can
144check those, and it only confuses the programmer. No wonder MicroSoft
145makes buggy programs.
146
147LOCAL variable names should be short, and to the point. If you have
148some random integer loop counter, it should probably be called "i".
149Calling it "loop_counter" is non-productive, if there is no chance of it
150being mis-understood. Similarly, "tmp" can be just about any type of
151variable that is used to hold a temporary value.
152
153If you are afraid to mix up your local variable names, you have another
154problem, which is called the function-growth-hormone-imbalance syndrome.
155See next chapter.
156
157
Randy Dunlap226a6b82006-06-23 02:05:58 -0700158 Chapter 5: Typedefs
159
160Please don't use things like "vps_t".
161
162It's a _mistake_ to use typedef for structures and pointers. When you see a
163
164 vps_t a;
165
166in the source, what does it mean?
167
168In contrast, if it says
169
170 struct virtual_container *a;
171
172you can actually tell what "a" is.
173
174Lots of people think that typedefs "help readability". Not so. They are
175useful only for:
176
177 (a) totally opaque objects (where the typedef is actively used to _hide_
178 what the object is).
179
180 Example: "pte_t" etc. opaque objects that you can only access using
181 the proper accessor functions.
182
183 NOTE! Opaqueness and "accessor functions" are not good in themselves.
184 The reason we have them for things like pte_t etc. is that there
185 really is absolutely _zero_ portably accessible information there.
186
187 (b) Clear integer types, where the abstraction _helps_ avoid confusion
188 whether it is "int" or "long".
189
190 u8/u16/u32 are perfectly fine typedefs, although they fit into
191 category (d) better than here.
192
193 NOTE! Again - there needs to be a _reason_ for this. If something is
194 "unsigned long", then there's no reason to do
195
196 typedef unsigned long myflags_t;
197
198 but if there is a clear reason for why it under certain circumstances
199 might be an "unsigned int" and under other configurations might be
200 "unsigned long", then by all means go ahead and use a typedef.
201
202 (c) when you use sparse to literally create a _new_ type for
203 type-checking.
204
205 (d) New types which are identical to standard C99 types, in certain
206 exceptional circumstances.
207
208 Although it would only take a short amount of time for the eyes and
209 brain to become accustomed to the standard types like 'uint32_t',
210 some people object to their use anyway.
211
212 Therefore, the Linux-specific 'u8/u16/u32/u64' types and their
213 signed equivalents which are identical to standard types are
214 permitted -- although they are not mandatory in new code of your
215 own.
216
217 When editing existing code which already uses one or the other set
218 of types, you should conform to the existing choices in that code.
219
220 (e) Types safe for use in userspace.
221
222 In certain structures which are visible to userspace, we cannot
223 require C99 types and cannot use the 'u32' form above. Thus, we
224 use __u32 and similar types in all structures which are shared
225 with userspace.
226
227Maybe there are other cases too, but the rule should basically be to NEVER
228EVER use a typedef unless you can clearly match one of those rules.
229
230In general, a pointer, or a struct that has elements that can reasonably
231be directly accessed should _never_ be a typedef.
232
233
234 Chapter 6: Functions
Linus Torvalds1da177e2005-04-16 15:20:36 -0700235
236Functions should be short and sweet, and do just one thing. They should
237fit on one or two screenfuls of text (the ISO/ANSI screen size is 80x24,
238as we all know), and do one thing and do that well.
239
240The maximum length of a function is inversely proportional to the
241complexity and indentation level of that function. So, if you have a
242conceptually simple function that is just one long (but simple)
243case-statement, where you have to do lots of small things for a lot of
244different cases, it's OK to have a longer function.
245
246However, if you have a complex function, and you suspect that a
247less-than-gifted first-year high-school student might not even
248understand what the function is all about, you should adhere to the
249maximum limits all the more closely. Use helper functions with
250descriptive names (you can ask the compiler to in-line them if you think
251it's performance-critical, and it will probably do a better job of it
252than you would have done).
253
254Another measure of the function is the number of local variables. They
255shouldn't exceed 5-10, or you're doing something wrong. Re-think the
256function, and split it into smaller pieces. A human brain can
257generally easily keep track of about 7 different things, anything more
258and it gets confused. You know you're brilliant, but maybe you'd like
259to understand what you did 2 weeks from now.
260
261
Randy Dunlap226a6b82006-06-23 02:05:58 -0700262 Chapter 7: Centralized exiting of functions
Linus Torvalds1da177e2005-04-16 15:20:36 -0700263
264Albeit deprecated by some people, the equivalent of the goto statement is
265used frequently by compilers in form of the unconditional jump instruction.
266
267The goto statement comes in handy when a function exits from multiple
268locations and some common work such as cleanup has to be done.
269
270The rationale is:
271
272- unconditional statements are easier to understand and follow
273- nesting is reduced
274- errors by not updating individual exit points when making
275 modifications are prevented
276- saves the compiler work to optimize redundant code away ;)
277
Jesper Juhldc3d28d2006-01-09 20:53:51 -0800278int fun(int a)
Linus Torvalds1da177e2005-04-16 15:20:36 -0700279{
280 int result = 0;
281 char *buffer = kmalloc(SIZE);
282
283 if (buffer == NULL)
284 return -ENOMEM;
285
286 if (condition1) {
287 while (loop1) {
288 ...
289 }
290 result = 1;
291 goto out;
292 }
293 ...
294out:
295 kfree(buffer);
296 return result;
297}
298
Randy Dunlap226a6b82006-06-23 02:05:58 -0700299 Chapter 8: Commenting
Linus Torvalds1da177e2005-04-16 15:20:36 -0700300
301Comments are good, but there is also a danger of over-commenting. NEVER
302try to explain HOW your code works in a comment: it's much better to
303write the code so that the _working_ is obvious, and it's a waste of
304time to explain badly written code.
305
306Generally, you want your comments to tell WHAT your code does, not HOW.
307Also, try to avoid putting comments inside a function body: if the
308function is so complex that you need to separately comment parts of it,
309you should probably go back to chapter 5 for a while. You can make
310small comments to note or warn about something particularly clever (or
311ugly), but try to avoid excess. Instead, put the comments at the head
312of the function, telling people what it does, and possibly WHY it does
313it.
314
Pekka J Enberge776eba2005-09-10 00:26:44 -0700315When commenting the kernel API functions, please use the kerneldoc format.
316See the files Documentation/kernel-doc-nano-HOWTO.txt and scripts/kernel-doc
317for details.
Linus Torvalds1da177e2005-04-16 15:20:36 -0700318
Randy Dunlap226a6b82006-06-23 02:05:58 -0700319 Chapter 9: You've made a mess of it
Linus Torvalds1da177e2005-04-16 15:20:36 -0700320
321That's OK, we all do. You've probably been told by your long-time Unix
322user helper that "GNU emacs" automatically formats the C sources for
323you, and you've noticed that yes, it does do that, but the defaults it
324uses are less than desirable (in fact, they are worse than random
325typing - an infinite number of monkeys typing into GNU emacs would never
326make a good program).
327
328So, you can either get rid of GNU emacs, or change it to use saner
329values. To do the latter, you can stick the following in your .emacs file:
330
331(defun linux-c-mode ()
332 "C mode with adjusted defaults for use with the Linux kernel."
333 (interactive)
334 (c-mode)
335 (c-set-style "K&R")
336 (setq tab-width 8)
337 (setq indent-tabs-mode t)
338 (setq c-basic-offset 8))
339
340This will define the M-x linux-c-mode command. When hacking on a
341module, if you put the string -*- linux-c -*- somewhere on the first
342two lines, this mode will be automatically invoked. Also, you may want
343to add
344
345(setq auto-mode-alist (cons '("/usr/src/linux.*/.*\\.[ch]$" . linux-c-mode)
346 auto-mode-alist))
347
348to your .emacs file if you want to have linux-c-mode switched on
349automagically when you edit source files under /usr/src/linux.
350
351But even if you fail in getting emacs to do sane formatting, not
352everything is lost: use "indent".
353
354Now, again, GNU indent has the same brain-dead settings that GNU emacs
355has, which is why you need to give it a few command line options.
356However, that's not too bad, because even the makers of GNU indent
357recognize the authority of K&R (the GNU people aren't evil, they are
358just severely misguided in this matter), so you just give indent the
359options "-kr -i8" (stands for "K&R, 8 character indents"), or use
360"scripts/Lindent", which indents in the latest style.
361
362"indent" has a lot of options, and especially when it comes to comment
363re-formatting you may want to take a look at the man page. But
364remember: "indent" is not a fix for bad programming.
365
366
Randy Dunlap226a6b82006-06-23 02:05:58 -0700367 Chapter 10: Configuration-files
Linus Torvalds1da177e2005-04-16 15:20:36 -0700368
369For configuration options (arch/xxx/Kconfig, and all the Kconfig files),
370somewhat different indentation is used.
371
372Help text is indented with 2 spaces.
373
374if CONFIG_EXPERIMENTAL
375 tristate CONFIG_BOOM
376 default n
377 help
378 Apply nitroglycerine inside the keyboard (DANGEROUS)
379 bool CONFIG_CHEER
380 depends on CONFIG_BOOM
381 default y
382 help
383 Output nice messages when you explode
384endif
385
386Generally, CONFIG_EXPERIMENTAL should surround all options not considered
387stable. All options that are known to trash data (experimental write-
388support for file-systems, for instance) should be denoted (DANGEROUS), other
389experimental options should be denoted (EXPERIMENTAL).
390
391
Randy Dunlap226a6b82006-06-23 02:05:58 -0700392 Chapter 11: Data structures
Linus Torvalds1da177e2005-04-16 15:20:36 -0700393
394Data structures that have visibility outside the single-threaded
395environment they are created and destroyed in should always have
396reference counts. In the kernel, garbage collection doesn't exist (and
397outside the kernel garbage collection is slow and inefficient), which
398means that you absolutely _have_ to reference count all your uses.
399
400Reference counting means that you can avoid locking, and allows multiple
401users to have access to the data structure in parallel - and not having
402to worry about the structure suddenly going away from under them just
403because they slept or did something else for a while.
404
405Note that locking is _not_ a replacement for reference counting.
406Locking is used to keep data structures coherent, while reference
407counting is a memory management technique. Usually both are needed, and
408they are not to be confused with each other.
409
410Many data structures can indeed have two levels of reference counting,
411when there are users of different "classes". The subclass count counts
412the number of subclass users, and decrements the global count just once
413when the subclass count goes to zero.
414
415Examples of this kind of "multi-level-reference-counting" can be found in
416memory management ("struct mm_struct": mm_users and mm_count), and in
417filesystem code ("struct super_block": s_count and s_active).
418
419Remember: if another thread can find your data structure, and you don't
420have a reference count on it, you almost certainly have a bug.
421
422
Randy Dunlap226a6b82006-06-23 02:05:58 -0700423 Chapter 12: Macros, Enums and RTL
Linus Torvalds1da177e2005-04-16 15:20:36 -0700424
425Names of macros defining constants and labels in enums are capitalized.
426
427#define CONSTANT 0x12345
428
429Enums are preferred when defining several related constants.
430
431CAPITALIZED macro names are appreciated but macros resembling functions
432may be named in lower case.
433
434Generally, inline functions are preferable to macros resembling functions.
435
436Macros with multiple statements should be enclosed in a do - while block:
437
438#define macrofun(a, b, c) \
439 do { \
440 if (a == 5) \
441 do_this(b, c); \
442 } while (0)
443
444Things to avoid when using macros:
445
4461) macros that affect control flow:
447
448#define FOO(x) \
449 do { \
450 if (blah(x) < 0) \
451 return -EBUGGERED; \
452 } while(0)
453
454is a _very_ bad idea. It looks like a function call but exits the "calling"
455function; don't break the internal parsers of those who will read the code.
456
4572) macros that depend on having a local variable with a magic name:
458
459#define FOO(val) bar(index, val)
460
461might look like a good thing, but it's confusing as hell when one reads the
462code and it's prone to breakage from seemingly innocent changes.
463
4643) macros with arguments that are used as l-values: FOO(x) = y; will
465bite you if somebody e.g. turns FOO into an inline function.
466
4674) forgetting about precedence: macros defining constants using expressions
468must enclose the expression in parentheses. Beware of similar issues with
469macros using parameters.
470
471#define CONSTANT 0x4000
472#define CONSTEXP (CONSTANT | 3)
473
474The cpp manual deals with macros exhaustively. The gcc internals manual also
475covers RTL which is used frequently with assembly language in the kernel.
476
477
Randy Dunlap226a6b82006-06-23 02:05:58 -0700478 Chapter 13: Printing kernel messages
Linus Torvalds1da177e2005-04-16 15:20:36 -0700479
480Kernel developers like to be seen as literate. Do mind the spelling
481of kernel messages to make a good impression. Do not use crippled
482words like "dont" and use "do not" or "don't" instead.
483
484Kernel messages do not have to be terminated with a period.
485
486Printing numbers in parentheses (%d) adds no value and should be avoided.
487
488
Randy Dunlap226a6b82006-06-23 02:05:58 -0700489 Chapter 14: Allocating memory
Pekka J Enbergaf4e5a22005-09-16 19:28:11 -0700490
491The kernel provides the following general purpose memory allocators:
492kmalloc(), kzalloc(), kcalloc(), and vmalloc(). Please refer to the API
493documentation for further information about them.
494
495The preferred form for passing a size of a struct is the following:
496
497 p = kmalloc(sizeof(*p), ...);
498
499The alternative form where struct name is spelled out hurts readability and
500introduces an opportunity for a bug when the pointer variable type is changed
501but the corresponding sizeof that is passed to a memory allocator is not.
502
503Casting the return value which is a void pointer is redundant. The conversion
504from void pointer to any other pointer type is guaranteed by the C programming
505language.
506
507
Randy Dunlap226a6b82006-06-23 02:05:58 -0700508 Chapter 15: The inline disease
Arjan van de Vena771f2b2006-01-08 01:05:04 -0800509
510There appears to be a common misperception that gcc has a magic "make me
511faster" speedup option called "inline". While the use of inlines can be
512appropriate (for example as a means of replacing macros, see Chapter 11), it
513very often is not. Abundant use of the inline keyword leads to a much bigger
514kernel, which in turn slows the system as a whole down, due to a bigger
515icache footprint for the CPU and simply because there is less memory
516available for the pagecache. Just think about it; a pagecache miss causes a
517disk seek, which easily takes 5 miliseconds. There are a LOT of cpu cycles
518that can go into these 5 miliseconds.
519
520A reasonable rule of thumb is to not put inline at functions that have more
521than 3 lines of code in them. An exception to this rule are the cases where
522a parameter is known to be a compiletime constant, and as a result of this
523constantness you *know* the compiler will be able to optimize most of your
524function away at compile time. For a good example of this later case, see
525the kmalloc() inline function.
526
527Often people argue that adding inline to functions that are static and used
528only once is always a win since there is no space tradeoff. While this is
529technically correct, gcc is capable of inlining these automatically without
530help, and the maintenance issue of removing the inline when a second user
531appears outweighs the potential value of the hint that tells gcc to do
532something it would have done anyway.
533
534
Alan Sternc16a02d2006-09-29 02:01:21 -0700535 Chapter 16: Function return values and names
536
537Functions can return values of many different kinds, and one of the
538most common is a value indicating whether the function succeeded or
539failed. Such a value can be represented as an error-code integer
540(-Exxx = failure, 0 = success) or a "succeeded" boolean (0 = failure,
541non-zero = success).
542
543Mixing up these two sorts of representations is a fertile source of
544difficult-to-find bugs. If the C language included a strong distinction
545between integers and booleans then the compiler would find these mistakes
546for us... but it doesn't. To help prevent such bugs, always follow this
547convention:
548
549 If the name of a function is an action or an imperative command,
550 the function should return an error-code integer. If the name
551 is a predicate, the function should return a "succeeded" boolean.
552
553For example, "add work" is a command, and the add_work() function returns 0
554for success or -EBUSY for failure. In the same way, "PCI device present" is
555a predicate, and the pci_dev_present() function returns 1 if it succeeds in
556finding a matching device or 0 if it doesn't.
557
558All EXPORTed functions must respect this convention, and so should all
559public functions. Private (static) functions need not, but it is
560recommended that they do.
561
562Functions whose return value is the actual result of a computation, rather
563than an indication of whether the computation succeeded, are not subject to
564this rule. Generally they indicate failure by returning some out-of-range
565result. Typical examples would be functions that return pointers; they use
566NULL or the ERR_PTR mechanism to report failure.
567
568
Arjan van de Vena771f2b2006-01-08 01:05:04 -0800569
Randy Dunlap226a6b82006-06-23 02:05:58 -0700570 Appendix I: References
Linus Torvalds1da177e2005-04-16 15:20:36 -0700571
572The C Programming Language, Second Edition
573by Brian W. Kernighan and Dennis M. Ritchie.
574Prentice Hall, Inc., 1988.
575ISBN 0-13-110362-8 (paperback), 0-13-110370-9 (hardback).
576URL: http://cm.bell-labs.com/cm/cs/cbook/
577
578The Practice of Programming
579by Brian W. Kernighan and Rob Pike.
580Addison-Wesley, Inc., 1999.
581ISBN 0-201-61586-X.
582URL: http://cm.bell-labs.com/cm/cs/tpop/
583
584GNU manuals - where in compliance with K&R and this text - for cpp, gcc,
Xose Vazquez Perez5b0ed2c2006-01-08 01:02:49 -0800585gcc internals and indent, all available from http://www.gnu.org/manual/
Linus Torvalds1da177e2005-04-16 15:20:36 -0700586
587WG14 is the international standardization working group for the programming
Xose Vazquez Perez5b0ed2c2006-01-08 01:02:49 -0800588language C, URL: http://www.open-std.org/JTC1/SC22/WG14/
589
590Kernel CodingStyle, by greg@kroah.com at OLS 2002:
591http://www.kroah.com/linux/talks/ols_2002_kernel_codingstyle_talk/html/
Linus Torvalds1da177e2005-04-16 15:20:36 -0700592
593--
Randy Dunlap226a6b82006-06-23 02:05:58 -0700594Last updated on 30 April 2006.